Facebook introduces PGP encryption for sensitive emails
Users of the social network can now opt to encrypt email notifications such as password resets and other confidential information
Facebook is offering users the ability to encrypt password reset emails for the first time, using the popular PGP email encryption standard.
Users who want to take advantage of the new security standards can tell Facebook their public key, and the site will then ensure that any sensitive emails that it sends out, such as password resets or other notifications, will be encrypted. The company will also cryptographically sign messages it sends, which allows users to verify that the sender genuinely is Facebook.
In a blogpost, Facebook explained how the feature will work. “Today we are gradually rolling out an experimental new feature that enables people to add OpenPGP public keys to their profile; these keys can be used to ‘end-to-end’ encrypt notification emails sent from Facebook to your preferred email accounts. People may also choose to share OpenPGP keys from their profile, with or without enabling encrypted notifications.”
The encryption standard Facebook is using, PGP (which stands for “pretty good privacy”), is seen as the gold standard of email encryption. The Edward Snowden revelations revealed it to be one of the few encryption standards which national security services had failed to undermine in some way, despite its 20-year history.
The standard is a form of what is called “public key cryptography”, where every user has pair of keys, one designed to be shared widely, and the other to be kept utterly secret. Messages are encrypted using the public key, and can then only be decrypted using the private one.
Giving the public key to Facebook thus solves two problems: it lets the site encrypt users’ emails, and it also aids dissemination of public keys.
Gnu Privacy Guard (or GPG), the specific version of PGP that Facebook has chosen to use, remains a notoriously difficult tool to employ, and it seems unlikely the encryption options will be widely used in the near future.
But the move underscores Facebook’s goal to roll out tools which will help vulnerable subsets of its userbase. The company says : “it’s very important to us that the people who use Facebook feel safe and can trust that their connection to Facebook is secure; for instance this is why we run connections to our site over [encryption standard] HTTPS with HSTS, and why we provide a Tor onion site for people who want to enjoy security guarantees beyond those offered by HTTPS.”
Users who want to take advantage of the new security standards can tell Facebook their public key, and the site will then ensure that any sensitive emails that it sends out, such as password resets or other notifications, will be encrypted. The company will also cryptographically sign messages it sends, which allows users to verify that the sender genuinely is Facebook.
In a blogpost, Facebook explained how the feature will work. “Today we are gradually rolling out an experimental new feature that enables people to add OpenPGP public keys to their profile; these keys can be used to ‘end-to-end’ encrypt notification emails sent from Facebook to your preferred email accounts. People may also choose to share OpenPGP keys from their profile, with or without enabling encrypted notifications.”
The encryption standard Facebook is using, PGP (which stands for “pretty good privacy”), is seen as the gold standard of email encryption. The Edward Snowden revelations revealed it to be one of the few encryption standards which national security services had failed to undermine in some way, despite its 20-year history.
The standard is a form of what is called “public key cryptography”, where every user has pair of keys, one designed to be shared widely, and the other to be kept utterly secret. Messages are encrypted using the public key, and can then only be decrypted using the private one.
Giving the public key to Facebook thus solves two problems: it lets the site encrypt users’ emails, and it also aids dissemination of public keys.
Gnu Privacy Guard (or GPG), the specific version of PGP that Facebook has chosen to use, remains a notoriously difficult tool to employ, and it seems unlikely the encryption options will be widely used in the near future.
But the move underscores Facebook’s goal to roll out tools which will help vulnerable subsets of its userbase. The company says : “it’s very important to us that the people who use Facebook feel safe and can trust that their connection to Facebook is secure; for instance this is why we run connections to our site over [encryption standard] HTTPS with HSTS, and why we provide a Tor onion site for people who want to enjoy security guarantees beyond those offered by HTTPS.”
- Philip Zimmermann: king of encryption reveals his fears for privacy
No comments:
Post a Comment